From: Radu Nicolau <radu.nicolau@intel.com>
To: Anoob Joseph <anoob.joseph@caviumnetworks.com>,
Akhil Goyal <akhil.goyal@nxp.com>,
Declan Doherty <declan.doherty@intel.com>,
Sergio Gonzalez Monroy <sergio.gonzalez.monroy@intel.com>
Cc: Narayana Prasad <narayanaprasad.athreya@caviumnetworks.com>,
Jerin Jacob <jerin.jacob@caviumnetworks.com>,
dev@dpdk.org
Subject: Re: [dpdk-dev] [PATCH 1/2] lib/security: add support for saving app cookie
Date: Mon, 20 Nov 2017 12:12:55 +0000 [thread overview]
Message-ID: <fdf07a4e-adf8-5cd0-0885-1999510390f3@intel.com> (raw)
In-Reply-To: <1511173905-22117-2-git-send-email-anoob.joseph@caviumnetworks.com>
Hi,
Why not have something similar to rte_security_set_pkt_metadata, for
example:
void *
rte_security_get_pkt_metadata(struct rte_security_ctx *instance,
struct rte_mbuf *mb);
and keep internally in the PMD all the required references. The returned
value will be device-specific, so it's flexible enough to include
anything required (just as void *params is in the set_pkt_metadata).
I think it will make a cleaner and more consistent implementation.
Regards,
Radu
On 11/20/2017 10:31 AM, Anoob Joseph wrote:
> In case of inline protocol processed ingress traffic, the packet may not
> have enough information to determine the security parameters with which
> the packet was processed. In such cases, the application could register
> a cookie, which will be saved in the the security session.
>
> As the ingress packets are received in the application, it will have
> some metadata set in the mbuf. Application can pass this metadata to
> "rte_security_session_get" API to retrieve the security session. Once
> the security session is determined, another driver call with the
> security session will give the application the cookie it had registered.
>
> The cookie will be registered while creating the security session.
> Without the cookie, the selector check (SP-SA check) for the incoming
> IPsec traffic won't be possible in the application.
>
> Application can choose what it should register as the cookie. It can
> register SPI or a pointer to SA.
>
> Signed-off-by: Anoob Joseph <anoob.joseph@caviumnetworks.com>
> ---
> lib/librte_security/rte_security.c | 26 +++++++++++++++++++++++
> lib/librte_security/rte_security.h | 30 +++++++++++++++++++++++++++
> lib/librte_security/rte_security_driver.h | 34 +++++++++++++++++++++++++++++++
> 3 files changed, 90 insertions(+)
>
> diff --git a/lib/librte_security/rte_security.c b/lib/librte_security/rte_security.c
> index 1227fca..1c706fe 100644
> --- a/lib/librte_security/rte_security.c
> +++ b/lib/librte_security/rte_security.c
> @@ -98,6 +98,32 @@ rte_security_session_destroy(struct rte_security_ctx *instance,
> return ret;
> }
>
> +struct rte_security_session *
> +rte_security_session_get(struct rte_security_ctx *instance,
> + uint64_t mdata)
> +{
> + struct rte_security_session *sess = NULL;
> +
> + RTE_FUNC_PTR_OR_ERR_RET(*instance->ops->session_get, NULL);
> + if (instance->ops->session_get(instance->device, mdata, &sess))
> + return NULL;
> +
> + return sess;
> +}
> +
> +uint64_t
> +rte_security_cookie_get(struct rte_security_ctx *instance,
> + struct rte_security_session *sess)
> +{
> + uint64_t cookie = 0;
> +
> + RTE_FUNC_PTR_OR_ERR_RET(*instance->ops->cookie_get, 0);
> + if (instance->ops->cookie_get(instance->device, sess, &cookie))
> + return 0;
> +
> + return cookie;
> +}
> +
> int
> rte_security_set_pkt_metadata(struct rte_security_ctx *instance,
> struct rte_security_session *sess,
> diff --git a/lib/librte_security/rte_security.h b/lib/librte_security/rte_security.h
> index 7e687d2..95f81ee 100644
> --- a/lib/librte_security/rte_security.h
> +++ b/lib/librte_security/rte_security.h
> @@ -273,6 +273,8 @@ struct rte_security_session_conf {
> /**< Configuration parameters for security session */
> struct rte_crypto_sym_xform *crypto_xform;
> /**< Security Session Crypto Transformations */
> + uint64_t cookie;
> + /**< Cookie registered by application */
> };
>
> struct rte_security_session {
> @@ -327,6 +329,34 @@ rte_security_session_destroy(struct rte_security_ctx *instance,
> struct rte_security_session *sess);
>
> /**
> + * Get the security session from the metadata set in mbuf.
> + *
> + * @param instance security instance
> + * @param mdata metadata set in mbuf during rx offload
> + * @return
> + * - On success, pointer to session
> + * - On failure, NULL
> + */
> +struct rte_security_session *
> +rte_security_session_get(struct rte_security_ctx *instance,
> + uint64_t mdata);
> +
> +/**
> + * Get the cookie set by application while creating the session. This could be
> + * used to identify the SA associated with the session.
> + *
> + * @param instance security instance
> + * @param sess security session
> + *
> + * @return
> + * - On success, cookie
> + * - On failure, 0
> + */
> +uint64_t
> +rte_security_cookie_get(struct rte_security_ctx *instance,
> + struct rte_security_session *sess);
> +
> +/**
> * Updates the buffer with device-specific defined metadata
> *
> * @param instance security instance
> diff --git a/lib/librte_security/rte_security_driver.h b/lib/librte_security/rte_security_driver.h
> index 997fbe7..f503be6a 100644
> --- a/lib/librte_security/rte_security_driver.h
> +++ b/lib/librte_security/rte_security_driver.h
> @@ -107,6 +107,36 @@ typedef int (*security_session_stats_get_t)(void *device,
> struct rte_security_stats *stats);
>
> /**
> + * Get the security session from the metadata set in mbuf.
> + *
> + * @param device Crypto/eth device pointer
> + * @param mdata Metadata set in mbuf during rx offload
> + * @param sess Pointer to return the security session retrieved
> + *
> + * @return
> + * - Returns 0 if the security session was successfully retrieved.
> + * - Returns -EINVAL if input parameters are invalid.
> + */
> +typedef int (*security_session_get_t)(void *device,
> + uint64_t mdata,
> + struct rte_security_session **sess);
> +
> +/**
> + * Get the cookie associated with the security session.
> + *
> + * @param device Crypto/eth device pointer
> + * @param sess Security session
> + * @param cookie Cookie associated with the security session
> + *
> + * @return
> + * - Returns 0 if the cookie was successfully retrieved.
> + * - Returns -EINVAL if input parameters are invalid.
> + */
> +typedef int (*security_cookie_get_t)(void *device,
> + struct rte_security_session *sess,
> + uint64_t *cookie);
> +
> +/**
> * Update the mbuf with provided metadata.
> *
> * @param sess Security session structure
> @@ -143,6 +173,10 @@ struct rte_security_ops {
> /**< Get security session statistics. */
> security_session_destroy_t session_destroy;
> /**< Clear a security sessions private data. */
> + security_session_get_t session_get;
> + /**< Get the security session associated with the metadata */
> + security_cookie_get_t cookie_get;
> + /**< Get the cookie associated with the security session */
> security_set_pkt_metadata_t set_pkt_metadata;
> /**< Update mbuf metadata. */
> security_capabilities_get_t capabilities_get;
next prev parent reply other threads:[~2017-11-20 12:12 UTC|newest]
Thread overview: 67+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-11-20 10:31 [dpdk-dev] [PATCH 0/2] add inline protocol support Anoob Joseph
2017-11-20 10:31 ` [dpdk-dev] [PATCH 1/2] lib/security: add support for saving app cookie Anoob Joseph
2017-11-20 12:12 ` Radu Nicolau [this message]
2017-11-20 15:32 ` Anoob
2017-11-20 17:49 ` Radu Nicolau
2017-11-20 19:09 ` Anoob Joseph
2017-11-21 10:15 ` Radu Nicolau
2017-11-20 10:31 ` [dpdk-dev] [PATCH 2/2] examples/ipsec-secgw: add support for inline protocol Anoob Joseph
2017-11-22 6:55 ` [dpdk-dev] [PATCH v2 0/2] add inline protocol support Anoob Joseph
2017-11-22 6:55 ` [dpdk-dev] [PATCH v2 1/2] lib/security: add support for get metadata Anoob Joseph
2017-11-22 11:29 ` Radu Nicolau
2017-11-22 11:52 ` Anoob
2017-11-22 12:12 ` Radu Nicolau
2017-11-22 13:27 ` Neil Horman
2017-11-22 14:13 ` Anoob
2017-11-27 13:55 ` Neil Horman
2017-11-22 6:55 ` [dpdk-dev] [PATCH v2 2/2] examples/ipsec-secgw: add support for inline protocol Anoob Joseph
2017-11-22 12:21 ` [dpdk-dev] [PATCH v2 0/2] add inline protocol support Nelio Laranjeiro
2017-11-22 12:55 ` Anoob
2017-11-22 13:05 ` Nelio Laranjeiro
2017-11-22 13:38 ` Anoob
2017-11-22 13:53 ` Anoob
2017-11-22 15:13 ` Anoob
2017-11-22 15:25 ` Nelio Laranjeiro
2017-11-23 11:19 ` [dpdk-dev] [PATCH v3 " Anoob Joseph
2017-11-23 11:19 ` [dpdk-dev] [PATCH v3 1/2] lib/security: add support for get metadata Anoob Joseph
2017-11-24 8:50 ` Akhil Goyal
2017-11-24 9:39 ` Radu Nicolau
2017-11-24 10:55 ` Akhil Goyal
2017-11-24 11:17 ` Radu Nicolau
2017-11-24 11:34 ` Akhil Goyal
2017-11-24 11:59 ` Radu Nicolau
2017-11-24 12:03 ` Akhil Goyal
2017-12-06 7:30 ` Anoob
2017-12-06 9:43 ` Radu Nicolau
2017-12-11 7:21 ` Anoob
2017-12-12 8:55 ` Akhil Goyal
2017-12-12 13:50 ` Anoob Joseph
2017-12-13 14:38 ` Akhil Goyal
2017-11-24 12:22 ` Anoob
2017-11-29 5:43 ` Anoob
2017-12-04 9:28 ` Akhil Goyal
2017-12-04 10:16 ` Anoob
2017-11-23 11:19 ` [dpdk-dev] [PATCH v3 2/2] examples/ipsec-secgw: add support for inline protocol Anoob Joseph
2017-12-11 11:02 ` Radu Nicolau
2017-12-15 8:30 ` [dpdk-dev] [PATCH v4 0/2] add inline protocol support Anoob Joseph
2017-12-15 8:30 ` [dpdk-dev] [PATCH v4 1/2] lib/security: add support for get userdata Anoob Joseph
2017-12-15 8:30 ` [dpdk-dev] [PATCH v4 2/2] examples/ipsec-secgw: add support for inline protocol Anoob Joseph
2017-12-15 8:43 ` [dpdk-dev] [PATCH v5 0/2] add inline protocol support Anoob Joseph
2017-12-15 8:43 ` [dpdk-dev] [PATCH v5 1/2] lib/security: add support for get userdata Anoob Joseph
2017-12-15 10:01 ` Akhil Goyal
2017-12-15 10:53 ` Anoob Joseph
2017-12-15 10:58 ` Akhil Goyal
2017-12-15 8:43 ` [dpdk-dev] [PATCH v5 2/2] examples/ipsec-secgw: add support for inline protocol Anoob Joseph
2017-12-15 9:39 ` Nelio Laranjeiro
2017-12-15 11:03 ` Anoob Joseph
2017-12-15 13:35 ` Nelio Laranjeiro
2017-12-15 10:04 ` Akhil Goyal
2017-12-15 11:16 ` Anoob Joseph
2017-12-18 7:15 ` [dpdk-dev] [PATCH v6 0/2] add inline protocol support Anoob Joseph
2017-12-18 7:15 ` [dpdk-dev] [PATCH v6 1/2] lib/security: add support for get userdata Anoob Joseph
2017-12-18 7:34 ` Akhil Goyal
2017-12-18 7:15 ` [dpdk-dev] [PATCH v6 2/2] examples/ipsec-secgw: add support for inline protocol Anoob Joseph
2018-01-08 16:10 ` De Lara Guarch, Pablo
2018-01-09 9:12 ` Akhil Goyal
2018-01-16 11:00 ` Nicolau, Radu
2018-01-09 16:05 ` [dpdk-dev] [PATCH v6 0/2] add inline protocol support De Lara Guarch, Pablo
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=fdf07a4e-adf8-5cd0-0885-1999510390f3@intel.com \
--to=radu.nicolau@intel.com \
--cc=akhil.goyal@nxp.com \
--cc=anoob.joseph@caviumnetworks.com \
--cc=declan.doherty@intel.com \
--cc=dev@dpdk.org \
--cc=jerin.jacob@caviumnetworks.com \
--cc=narayanaprasad.athreya@caviumnetworks.com \
--cc=sergio.gonzalez.monroy@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).